{"record":{"id":"c24577a206dcae53","repo":"apereo/cas","slug":"failed-to-establish-a-connection-ldap-and-search","errorCode":null,"errorMessage":"Failed to establish a connection ldap and search.","messagePattern":"Failed to establish a connection ldap and search\\.","errorType":"exception","errorClass":"CertificateException","httpStatus":null,"severity":"error","filePath":"support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/ldap/LdaptiveResourceCRLFetcher.java","lineNumber":102,"sourceCode":"        try {\n            val ldapURL = r.toString();\n            LOGGER.debug(\"Fetching CRL from ldap [{}]\", ldapURL);\n\n            val result = performLdapSearch(ldapURL);\n            if (result.isSuccess()) {\n                val entry = result.getEntry();\n                val attribute = Objects.requireNonNull(entry.getAttribute(this.certificateAttribute),\n                    () -> String.format(\"Certificate attribute %s does not exist or has no value\", this.certificateAttribute));\n\n                if (attribute.isBinary()) {\n                    LOGGER.debug(\"Located entry [{}]. Retrieving first attribute [{}]\", entry, attribute);\n                    return fetchX509CRLFromAttribute(attribute);\n                }\n                LOGGER.warn(\"Found certificate attribute [{}] but it is not marked as a binary attribute\", this.certificateAttribute);\n            }\n\n            LOGGER.debug(\"Failed to execute the search [{}]\", result);\n            throw new CertificateException(\"Failed to establish a connection ldap and search.\");\n\n        } catch (final Exception e) {\n            LoggingUtils.error(LOGGER, e);\n            throw new CertificateException(e.getMessage());\n        }\n    }\n\n\n    /**\n     * Gets x509 cRL from attribute. Retrieves the binary attribute value,\n     * decodes it to base64, and fetches it as a byte-array resource.\n     *\n     * @param attribute the attribute, which may be null if it's not found\n     * @return the x 509 cRL from attribute\n     * @throws Exception the exception\n     */\n    protected X509CRL fetchX509CRLFromAttribute(final LdapAttribute attribute) throws Exception {\n        val val = attribute.getBinaryValue();","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/apereo/cas/blob/e7288fc434b4f4505b8452e1a57e8fb3111bb863/support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/ldap/LdaptiveResourceCRLFetcher.java#L84-L120","documentation":"LdaptiveResourceCRLFetcher.fetchCRLFromLdap() searches LDAP for the configured CRL/certificate attribute and decodes it into an X509CRL. When the search cannot be executed or returns nothing usable (connection failure, wrong base DN, attribute missing or not binary), it throws CertificateException with this generic message; the underlying cause is logged via LoggingUtils.","triggerScenarios":"fetch() delegates to fetchCRLFromLdap() and the ldaptive search fails or yields no result — unreachable LDAP host, bad bind credentials, non-existent base DN, or the CRL attribute absent/not flagged binary (the code warns when the attribute is present but not binary).","commonSituations":"LDAP-based CRL revocation checking enabled; firewall/DNS changes break connectivity; base DN or search-filter typos in cas.authn.x509 LDAP settings; directory stores the CRL without the binary option so raw bytes cannot be decoded.","solutions":["Read the logged underlying exception to get the true cause, then fix connectivity/credentials (test with ldapsearch -H ldap://host -b baseDn).","Verify base DN, search filter, and the CRL attribute name match the directory schema.","Flag the CRL attribute as binary in LDAP and ensure the fetcher reads the binary attribute.","Confirm the CRL entry exists at the searched DN with correct scope/filter."],"exampleFix":"// before\ncas.authn.x509.ldap.base-dn=ou=certs,dc=example,dc=org\ncas.authn.x509.ldap.search-filter=(cn={user})\n// after\ncas.authn.x509.ldap.base-dn=ou=pki,dc=example,dc=com\ncas.authn.x509.ldap.search-filter=(cn={user})\n# and mark the CRL attribute binary in the directory","handlingStrategy":"try-catch","validationCode":"try (var conn = new LdapConnection(host, port, bindDn, bindPassword)) { conn.open(); } catch (Exception e) { /* LDAP unreachable: fix before enabling CRL fetch */ }","typeGuard":null,"tryCatchPattern":"try {\n    crlFetcher.fetch(cert);\n} catch (CertificateException e) {\n    LOGGER.warn(\"CRL fetch from LDAP failed; falling back to offline CRL\", e);\n}","preventionTips":["Monitor LDAP reachability (ports, firewalls, DNS) from CAS hosts.","Verify base DN, search filter, and attribute names against the schema.","Mark CRL attributes binary in the directory and in config.","Configure an on-disk CRL fallback resource."],"tags":["ldap","crl","x509","revocation","network"],"backgroundTag":"ldap-search-failed","analyzedSha":"e7288fc434b4f4505b8452e1a57e8fb3111bb863","analyzedAt":"2026-09-08T15:39:16.015Z","contentChangedAt":"2026-09-08T15:39:16.015Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}